Database Reference

p2pstream stores server state in SQLite unless DATABASE_URL points somewhere else.

Exact Fields And Defaults

When DATABASE_URL is unset, the database path is:

${CONFIG_DIR}/p2pstream.db

Docker sets:

CONFIG_DIR=/data

So the default Compose database path is:

/data/p2pstream.db

SQLite is opened with WAL journal mode, synchronous normal, busy timeout 10000 ms, foreign keys enabled, and private cache.

Validation Rules

• Backups should include p2pstream.db, p2pstream.db-wal, and p2pstream.db-shm.
• Do not edit the database by hand while the server is running.
• If DATABASE_URL is empty, p2pstream creates CONFIG_DIR and the certs directory with 0700 permissions.

Runtime Effects

Conceptual table groups:

Area	Tables
Auth	users, sessions, management_access_tokens
Agents	agents, connections, agent_stats
Environments	environments
Public proxy	public_listeners, public_routes, public_route_targets, public_agent_labels, public_response_templates
Target headers	public_route_target_upstream_headers, public_route_target_response_headers
TLS	public_tls_certificates, public_tls_dns_credentials
Controls	public_access_providers, public_access_policies, public_rate_limit_rules, public_waf_captcha_providers, public_waf_rules, public_waf_settings, public_geo_ip_settings, public_trusted_proxy_sources, public_traffic_shaper_rules, public_cache_settings, public_cache_rules, public_cache_entries
Observability	proxy_request_events

Existing databases must have valid Goose migration history. Fresh databases are initialized automatically. Startup requires supported configuration and completed observability backfills; it does not convert unsupported persisted layouts. Keep a full backup and its matching image before changing versions; see Upgrades.

The database is stored under CONFIG_DIR unless DATABASE_URL names an explicit location. A working-directory database is not copied automatically. Stop the server before moving it together with its SQLite sidecar files.

public_waf_settings stores the cookie signing secret used for WAF pass, admission, and queue cookies. GeoIP settings store the redacted-at-API MaxMind download credentials and database refresh state; trusted-proxy rows store explicit provider/custom trust plus the last valid managed CIDR snapshot. public_retry_rules stores opt-in method, failure-boundary, replay, route/target filter, and match configuration. proxy_request_events includes WAF, cache, retry, route, route target, agent, byte, status, and duration fields. agent_stats includes reported agent CPU percentage for dashboard summaries and automatic WAF activation.

Examples

Backup files:

p2pstream.db
p2pstream.db-wal
p2pstream.db-shm
certs/
geoip/

Explicit SQLite URL for local recovery commands:

p2pstream users reset-password admin \
  --database-url 'file:/var/lib/p2pstream/p2pstream.db?mode=rwc'

Related Tasks

• Backup and restore
• First login
• Configuration reference